HTTP Request Builder
Send bounded browser Fetch requests with the exact destination disclosed first.
Working notes
Use HTTP Request Builder with the boundary visible.
HTTP Request Builder sends a bounded browser Fetch request directly to the exact HTTPS destination shown before Send; StackCache does not proxy it.
What is HTTP Request Builder?
An HTTP request builder lets you construct and send HTTP requests with full control over the method, URL, headers, body, and credentials mode — all from your browser. This is essential for API development, debugging, and testing. Unlike tools like Postman or Insomnia that run as desktop applications, this tool sends requests directly from the browser using the Fetch API, which means the request is subject to the same CORS, TLS, and security policies as your web application. This is both a limitation and an advantage: you see exactly how the browser will behave when your frontend makes the same request, including CORS preflight handling, cookie attachment, and mixed-content blocking. The request goes directly from your browser to the destination — StackCache does not proxy, relay, log, or cache any request or response data. You can add custom headers (including Authorization), set the request body (JSON, form data, plain text), and inspect the full response including status code, headers, timing, and body.
When to use it
- Testing REST APIs — send GET, POST, PUT, PATCH, and DELETE requests to verify API behavior during development.
- Debugging CORS issues — send a request from the browser to see the actual CORS preflight and error behavior your frontend encounters.
- Verifying authentication — test that your API correctly accepts or rejects requests with different Authorization headers.
- Inspecting response headers — check caching headers (Cache-Control, ETag), security headers (CSP, HSTS), and CORS headers on API responses.
- Webhook testing — send POST requests with custom JSON payloads to test webhook endpoints.
How to use it
- 01Choose the HTTP method: GET, POST, PUT, PATCH, DELETE, HEAD, or OPTIONS.
- 02Enter the destination URL (HTTPS required for most cross-origin requests).
- 03Add custom headers and set the credentials mode (omit, same-origin, or include).
- 04For methods with a body (POST, PUT, PATCH), enter the request body and set the Content-Type header.
- 05Review the normalized origin and any sensitive-header warnings, then click Send.
- 06Inspect the response: status code, headers, body, and timing.
Common mistakes
- CORS blocking the request — the destination server must include Access-Control-Allow-Origin headers. If it does not, the browser blocks the response. This is a server-side configuration issue.
- Mixed content — browsers block HTTP requests from HTTPS pages. Ensure the destination URL uses HTTPS.
- Missing Content-Type header — when sending JSON, set Content-Type to application/json. Without it, the server may misinterpret the body.
- Forbidden headers — browsers prevent setting some headers (Host, Origin, Referer, Cookie without credentials mode). This is a browser security policy, not a tool limitation.
- Cookie handling — cookies are only sent when credentials mode is set to "include" or "same-origin" and the server responds with Access-Control-Allow-Credentials: true.
Synthetic example
Build a public health request
Input
GET https://api.example.test/health
Result
The browser contacts the displayed origin only after Send.
Related standards
Limits and data boundary
- The destination must permit the request under CORS, TLS, mixed-content, cookie, and forbidden-header rules.
- The destination receives anything you deliberately send and handles it under its own policy.
Frequently asked questions
- Does this tool proxy my HTTP requests?
- No. Requests go directly from your browser to the destination URL. StackCache does not relay, log, or cache any request or response.
- Why do I get a CORS error?
- CORS errors occur when the destination server does not include Access-Control-Allow-Origin headers permitting browser requests. This is a server-side restriction, not a StackCache limitation.
- Can I test APIs that require authentication?
- Yes. You can add custom headers including Authorization, API keys, and cookies. Credentials are sent directly to the destination and are not stored by StackCache.
- Can I send requests to localhost?
- Yes, if your local server is running on HTTPS or the browser allows mixed content. HTTP localhost requests may work in some browsers due to special-case handling.
Keep working